summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-04-01qcow2: Validate active L1 table offset and size (CVE-2014-0144)Kevin Wolf3-0/+45
This avoids an unbounded allocation. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: Validate snapshot table offset/size (CVE-2014-0144)Kevin Wolf5-26/+91
This avoid unbounded memory allocation and fixes a potential buffer overflow on 32 bit hosts. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: Validate refcount table offsetKevin Wolf3-0/+56
The end of the refcount table must not exceed INT64_MAX so that integer overflows are avoided. Also check for misaligned refcount table. Such images are invalid and probably the result of data corruption. Error out to avoid further corruption. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: Check refcount table size (CVE-2014-0144)Kevin Wolf4-1/+29
Limit the in-memory reference count table size to 8 MB, it's enough in practice. This fixes an unbounded allocation as well as a buffer overflow in qcow2_refcount_init(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: Check backing_file_offset (CVE-2014-0144)Kevin Wolf3-0/+25
Header, header extension and the backing file name must all be stored in the first cluster. Setting the backing file to a much higher value allowed header extensions to become much bigger than we want them to be (unbounded allocation). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: Check header_length (CVE-2014-0144)Kevin Wolf4-9/+96
This fixes an unbounded allocation for s->unknown_header_fields. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01curl: check data size before memcpy to local buffer. (CVE-2014-0144)Fam Zheng1-0/+5
curl_read_cb is callback function for libcurl when data arrives. The data size passed in here is not guaranteed to be within the range of request we submitted, so we may overflow the guest IO buffer. Check the real size we have before memcpy to buffer to avoid overflow. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01vhdx: Bounds checking for block_size and logical_sector_size (CVE-2014-0148)Jeff Cody1-2/+10
Other variables (e.g. sectors_per_block) are calculated using these variables, and if not range-checked illegal values could be obtained causing infinite loops and other potential issues when calculating BAT entries. The 1.00 VHDX spec requires BlockSize to be min 1MB, max 256MB. LogicalSectorSize is required to be either 512 or 4096 bytes. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01vdi: add bounds checks for blocks_in_image and disk_size header fields ↵Jeff Cody1-4/+33
(CVE-2014-0144) The maximum blocks_in_image is 0xffffffff / 4, which also limits the maximum disk_size for a VDI image to 1024TB. Note that this is the maximum size that QEMU will currently support with this driver, not necessarily the maximum size allowed by the image format. This also fixes an incorrect error message, a bug introduced by commit 5b7aa9b56d1bfc79916262f380c3fc7961becb50 (Reported by Stefan Weil) Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01vpc: Validate block size (CVE-2014-0142)Kevin Wolf4-0/+87
This fixes some cases of division by zero crashes. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01vpc/vhd: add bounds check for max_table_entries and block_size (CVE-2014-0144)Jeff Cody1-4/+23
This adds checks to make sure that max_table_entries and block_size are in sane ranges. Memory is allocated based on max_table_entries, and block_size is used to calculate indices into that allocated memory, so if these values are incorrect that can lead to potential unbounded memory allocation, or invalid memory accesses. Also, the allocation of the pagetable is changed from g_malloc0() to qemu_blockalign(). Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01bochs: Fix bitmap offset calculationKevin Wolf1-2/+3
32 bit truncation could let us access the wrong offset in the image. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01bochs: Check extent_size header field (CVE-2014-0142)Kevin Wolf3-0/+29
This fixes two possible division by zero crashes: In bochs_open() and in seek_to_sector(). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01bochs: Check catalog_size header field (CVE-2014-0143)Kevin Wolf3-1/+35
It should neither become negative nor allow unbounded memory allocations. This fixes aborts in g_malloc() and an s->catalog_bitmap buffer overflow on big endian hosts. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01bochs: Use unsigned variables for offsets and sizes (CVE-2014-0147)Kevin Wolf3-8/+20
Gets us rid of integer overflows resulting in negative sizes which aren't correctly checked. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01bochs: Unify header structs and make them QEMU_PACKEDKevin Wolf1-42/+25
This is an on-disk structure, so offsets must be accurate. Before this patch, sizeof(bochs) != sizeof(header_v1), which makes the memcpy() between both invalid. We're lucky enough that the destination buffer happened to be the larger one, and the memcpy size to be taken from the smaller one, so we didn't get a buffer overflow in practice. This patch unifies the both structures, eliminating the need to do a memcpy in the first place. The common fields are extracted to the top level of the struct and the actually differing part gets a union of the two versions. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qemu-iotests: Support for bochs formatKevin Wolf5-0/+67
Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01block/cloop: fix offsets[] size off-by-oneStefan Hajnoczi3-7/+14
cloop stores the number of compressed blocks in the n_blocks header field. The file actually contains n_blocks + 1 offsets, where the extra offset is the end-of-file offset. The following line in cloop_read_block() results in an out-of-bounds offsets[] access: uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num]; This patch allocates and loads the extra offset so that cloop_read_block() works correctly when the last block is accessed. Notice that we must free s->offsets[] unconditionally now since there is always an end-of-file offset. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01block/cloop: refuse images with bogus offsets (CVE-2014-0144)Stefan Hajnoczi3-5/+52
The offsets[] array allows efficient seeking and tells us the maximum compressed data size. If the offsets are bogus the maximum compressed data size will be unrealistic. This could cause g_malloc() to abort and bogus offsets mean the image is broken anyway. Therefore we should refuse such images. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01block/cloop: refuse images with huge offsets arrays (CVE-2014-0144)Stefan Hajnoczi3-0/+19
Limit offsets_size to 512 MB so that: 1. g_malloc() does not abort due to an unreasonable size argument. 2. offsets_size does not overflow the bdrv_pread() int size argument. This limit imposes a maximum image size of 16 TB at 256 KB block size. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01block/cloop: prevent offsets_size integer overflow (CVE-2014-0143)Stefan Hajnoczi3-0/+18
The following integer overflow in offsets_size can lead to out-of-bounds memory stores when n_blocks has a huge value: uint32_t n_blocks, offsets_size; [...] ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4); [...] s->n_blocks = be32_to_cpu(s->n_blocks); /* read offsets */ offsets_size = s->n_blocks * sizeof(uint64_t); s->offsets = g_malloc(offsets_size); [...] for(i=0;i<s->n_blocks;i++) { s->offsets[i] = be64_to_cpu(s->offsets[i]); offsets_size can be smaller than n_blocks due to integer overflow. Therefore s->offsets[] is too small when the for loop byteswaps offsets. This patch refuses to open files if offsets_size would overflow. Note that changing the type of offsets_size is not a fix since 32-bit hosts still only have 32-bit size_t. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01block/cloop: validate block_size header field (CVE-2014-0144)Stefan Hajnoczi3-0/+55
Avoid unbounded s->uncompressed_block memory allocation by checking that the block_size header field has a reasonable value. Also enforce the assumption that the value is a non-zero multiple of 512. These constraints conform to cloop 2.639's code so we accept existing image files. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qemu-iotests: add cloop input validation testsStefan Hajnoczi4-0/+60
Add a cloop format-specific test case. Later patches add tests for input validation to the script. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qemu-iotests: add ./check -cloop supportStefan Hajnoczi2-0/+10
Add the cloop block driver to qemu-iotests. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qcow2: fix two memory leaks in qcow2_open error code pathPrasad Joshi1-0/+4
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01vvfat: Fix :floppy: option to suppress partition tableMarkus Armbruster1-1/+1
Regressed in commit 7ad9be6, v1.5.0. Reported-by: Kiyokazu SUTO <suto@ks-and-ks.ne.jp> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-04-01qemu-img: Release reference to BlockDriverStatePrasad Joshi1-0/+1
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-03-31configure: add option to disable -fstack-protector flagsSteven Noonan1-3/+15
The -fstack-protector flag family is useful for ensuring safety and for debugging, but has a performance impact. Here are some boot time comparisons of the various versions of -fstack-protector using qemu-system-arm on an x86_64 host: # -fstack-protector-all Startup finished in 1.810s (kernel) + 12.331s (initrd) + 49.016s (userspace) = 1min 3.159s Startup finished in 1.801s (kernel) + 12.287s (initrd) + 47.925s (userspace) = 1min 2.013s Startup finished in 1.812s (kernel) + 12.302s (initrd) + 47.995s (userspace) = 1min 2.111s # -fstack-protector-strong Startup finished in 1.744s (kernel) + 11.223s (initrd) + 44.688s (userspace) = 57.657s Startup finished in 1.721s (kernel) + 11.222s (initrd) + 44.194s (userspace) = 57.138s Startup finished in 1.693s (kernel) + 11.250s (initrd) + 44.426s (userspace) = 57.370s # -fstack-protector Startup finished in 1.705s (kernel) + 11.409s (initrd) + 43.563s (userspace) = 56.677s Startup finished in 1.877s (kernel) + 11.137s (initrd) + 43.719s (userspace) = 56.734s Startup finished in 1.708s (kernel) + 11.141s (initrd) + 43.628s (userspace) = 56.478s # no stack protector Startup finished in 1.743s (kernel) + 11.190s (initrd) + 43.709s (userspace) = 56.643s Startup finished in 1.763s (kernel) + 11.216s (initrd) + 43.767s (userspace) = 56.747s Startup finished in 1.711s (kernel) + 11.283s (initrd) + 43.878s (userspace) = 56.873s This patch introduces a configure option to disable the stack protector entirely, and conditional stack protector flag selection (in order, based on availability): -fstack-protector-strong, -fstack-protector-all, no stack protector. Signed-off-by: Steven Noonan <snoonan@amazon.com> Cc: Anthony Liguori <aliguori@amazon.com> Reviewed-by: Stefan Weil <sw@weilnetz.de> [Prefer -fstack-protector-all to -fstack-protector, suggested by Laurent Desnogues. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31pci: Fix clearing IRQs on resetCole Robinson1-2/+2
irq_state is cleared before calling pci_device_deassert_intx, but the latter misbehaves if the former isn't accurate. In this case, any raised IRQs are not cleared, which hits an assertion in pcibus_reset: qemu-system-x86_64: hw/pci/pci.c:250: pcibus_reset: Assertion `bus->irq_count[i] == 0' failed. pci_device_deassert_intx should clear irq_state anyways, so add an assert. This fixes migration with usb2 + usb-tablet. Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-id: 7da1ad94ce027183b4049c2de370cb191b0073c1.1396290569.git.crobinso@redhat.com Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31Merge remote-tracking branch 'remotes/afaerber/tags/qom-cpu-for-2.0' into ↵Peter Maydell2-1/+17
staging QOM CPUState refactorings / X86CPU * X86CPU IA32e 1GB paging support * Performance quickfix for CPU() cast macro # gpg: Signature made Mon 31 Mar 2014 18:33:27 BST using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-cpu-for-2.0: cpu: Avoid QOM casts for CPU() target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-31cpu: Avoid QOM casts for CPU()Andreas Färber1-1/+6
CPU address spaces touching load and store helpers as well as the movement of (almost) all fields from CPU_COMMON to CPUState have led to a noticeable increase of CPU() usage in "hot" paths for both TCG and KVM. While CPU()'s OBJECT_CHECK() might help detect development errors, i.e. in form of crashes due to QOM vs. non-QOM mismatches rather than QOM type mismatches, it is not really needed at runtime since mostly used in CPU-specific paths, coming from a target-specific CPU subtype. If that pointer is damaged, other errors are highly likely to occur elsewhere anyway. Keep the CPU() macro for a consistent developer experience and for flexibility to exchange its implementation, but turn it into a pure, unchecked C cast for now. Compare commit 6e42be7cd10260fd3a006d94f6c870692bf7a2c0. Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31target-i386: x86_cpu_get_phys_page_debug(): support 1GB page translationLuiz Capitulino1-0/+11
Linux guests, when using more than 4GB of RAM, may end up using 1GB pages to store (kernel) data. When this happens, we're unable to debug a running Linux kernel with GDB: (gdb) p node_data[0]->node_id Cannot access memory at address 0xffff88013fffd3a0 (gdb) GDB returns this error because x86_cpu_get_phys_page_debug() doesn't support translating 1GB pages in IA-32e paging mode and returns an error to GDB. This commit adds support for 1GB page translation for IA32e paging. Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-31make-release: Record SeaBIOS versionAndreas Färber1-0/+1
Before deleting .git, determine the version and save it in .version file. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Message-id: 1395277315-7806-1-git-send-email-afaerber@suse.de Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-28Merge remote-tracking branch 'remotes/rth/tcg-arm-unaligned' into stagingPeter Maydell1-4/+17
* remotes/rth/tcg-arm-unaligned: tcg-arm: Avoid ldrd/strd for user-only emulation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-28Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell5-6/+52
acpi,pc,build bug fixes Here are some bugfixes for 2.0. A bugfix for acpi for pci bridges, and a build fix for old systems without pthread_setname_np: both fix regressions so we definitely want to include them. HPET fix is not for a regression but looks very safe, fixes a nasty bug and has been on list for a while. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 28 Mar 2014 12:00:12 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi: fix ACPI generation for pci bridges Don't enable a HPET timer if HPET is disabled Detect pthread_setname_np at configure time Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-28acpi: fix ACPI generation for pci bridgesMarcel Apfelbaum1-2/+2
Commit 8dcf525abc5dff785251a881f9764dd961065c0d acpi-build: append description for non-hotplug appended description for all occupied non hotpluggable PCI slots. However the bridge devices are already added to SSDT, adding them again will create an incorrect SSDT table. Fixed by skipping the pci bridge devices, marking them as 'system'. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-03-27tcg-arm: Avoid ldrd/strd for user-only emulationRichard Henderson1-4/+17
The arm ldrd/strd insns must cause alignment traps, whereas at least for armv7 ldr/str must handle unaligned operations. While this is hardly the only problem facing user-only emu, this solves one problem for i386 on armv7 emulation. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reported-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Richard Henderson <rth@twiddle.net>
2014-03-27Merge remote-tracking branch 'remotes/afaerber/tags/ppc-for-2.0' into stagingPeter Maydell2-5/+5
PowerPC queue for 2.0 * OpenPIC fix * MSR fixes for POWER7 upwards * TCG instruction set support fix for POWER8 # gpg: Signature made Thu 27 Mar 2014 16:12:12 GMT using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/ppc-for-2.0: target-ppc: MSR_POW not supported on POWER7/7+/8 target-ppc: POWER7+ supports the MSR_VSX bit target-ppc: POWER8 supports isel target-ppc: POWER8 supports the MSR_LE bit intc/openpic_kvm: Fix MemListener delete region callback function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-03-27' ↵Peter Maydell31-261/+276
into staging trivial patches for 2014-03-27 # gpg: Signature made Thu 27 Mar 2014 15:23:53 GMT using RSA key ID 74F0C838 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: E190 8639 3B10 B51B AC2C 8B73 5253 C5AD 74F0 C838 * remotes/mjt/tags/trivial-patches-2014-03-27: (23 commits) linux-user: remove duplicate statement hw/timer/grlib_gptimer: remove unnecessary assignment hw/pci-host/apb.c: Avoid shifting left into sign bit hw/intc/xilinx_intc: Avoid shifting left into sign bit hw/intc/slavio_intctl: Avoid shifting left into sign bit tests/libqos/pci-pc: Avoid shifting left into sign bit hw/ppc: Avoid shifting left into sign bit hw/intc/openpic: Avoid shifting left into sign bit hw/usb/hcd-ohci.c: Avoid shifting left into sign bit target-mips: Avoid shifting left into sign bit hw/i386/acpi_build.c: Avoid shifting left into sign bit hw/pci/pci_host.c: Avoid shifting left into sign bit hw/intc/apic.c: Use uint32_t for mask word in foreach_apic target-i386: Avoid shifting left into sign bit CODING_STYLE: Section about mixed declarations doc: update default PowerPC framebuffer settings doc: update sun4m documentation fix return check for KVM_GET_DIRTY_LOG ioctl target-i386: Add missing 'static' and 'const' attributes util: Add 'static' attribute to function implementation ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27Don't enable a HPET timer if HPET is disabledMatt Lupfer1-1/+2
A HPET timer can be started when HPET is not yet enabled. This will not generate an interrupt to the guest, but causes problems when HPET is later enabled. A timer that is created and expires at least once before HPET is enabled will have an initialized comparator based on a hpet_offset of 0 (uninitialized). When HPET is enabled, hpet_set_timer() is called a second time, which modifies the timer expiry to a time based on the difference between current ticks (measured with the newly initialized hpet_offset) and the timer's comparator (which was generated before hpet_offset was initialized). This results in a long period of no HPET timer ticks. When this occurs with a CentOS 5.x guest, the guest may not receive timer interrupts during its narrow timer check window and panic on boot. Signed-off-by: Matt Lupfer <mlupfer@ddn.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-03-27Detect pthread_setname_np at configure timeDr. David Alan Gilbert3-3/+48
Warn if no way of setting thread name is available. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-03-27Merge remote-tracking branch ↵Peter Maydell2-2/+2
'remotes/pmaydell/tags/pull-target-arm-20140327' into staging target-arm queue: * Don't default to integratorcp board if no machine specified # gpg: Signature made Thu 27 Mar 2014 14:09:12 GMT using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140327: vl.c: Improve message when no default machine is found hw/arm: Stop specifying integratorcp as the default board Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-03-27linux-user: remove duplicate statementPrasad Joshi1-2/+0
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com> Acked-by: Riku Voipio <riku.voipio@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/timer/grlib_gptimer: remove unnecessary assignmentPrasad Joshi1-1/+0
Signed-off-by: Prasad Joshi <prasadjoshi.linux@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/pci-host/apb.c: Avoid shifting left into sign bitPeter Maydell1-5/+5
Add U suffix to avoid undefined behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/intc/xilinx_intc: Avoid shifting left into sign bitPeter Maydell1-1/+2
Avoid undefined behaviour shifting left into the sign bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/intc/slavio_intctl: Avoid shifting left into sign bitPeter Maydell1-1/+1
Add 'U' suffix to avoid undefined behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27tests/libqos/pci-pc: Avoid shifting left into sign bitPeter Maydell1-6/+6
Add U suffix when doing "1 << 31" to avoid undefined behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/ppc: Avoid shifting left into sign bitPeter Maydell5-18/+18
Add U suffix to various places where we were doing "1 << 31", which is undefined behaviour, and also to other constant definitions in the same groups, for consistency. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-03-27hw/intc/openpic: Avoid shifting left into sign bitPeter Maydell1-7/+7
Add U suffix to avoid undefined behaviour. This is only strictly necessary for the 1 << 31 cases; for consistency we extend it to other constants in the same group. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-03 23:00:22 +0000